Question

Today I made a code that should do a login but sadly it wont.

here is what I tried:

include('php/mysqlcon.php');
if($_SERVER['REQUEST_METHOD'] == 'POST') {
    $username = $_POST['username'];
    $password = sha1($_POST['password']);
    $query = mysql_query("SELECT * FROM user WHERE username=$username AND password=$password");
    $query_rows = mysql_num_rows($query);
    if($query_rows > 0) {
        session_start();
        $_SESSION['username'] = $username;
        header('Location: index.php');
    } else {
        echo('bad login');
    }
}

The mysql details are in the mysqlcon.php, and Im sure they are correct

Answer 1

You need to put quotes around your username and password in the query. Also, make sure you filter the input since your code is prone to mysql injection.